PT-2023-32311 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.2.33 and earlier Description: The issue is related to improper access control in the password analyzer feature, allowing an attacker to bypass permissions via data source switching. This can be...

PT-2023-32409 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to resolve...

PT-2023-32406 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository pkp/pkp-lib. CSRF is an attack that tricks the victim into performing unintended actions on a web application...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unregister flowtable hooks on netns exit CVE-2022-48935 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: double hook unregistration in netns path...

PT-2023-32397 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or lat...

PT-2023-29753 · Idnovate · Idnovate Superuser

Name of the Vulnerable Software and Affected Versions: idnovate superuser versions prior to 2.4.2 Description: The issue allows attackers to bypass authentication via a crafted HTTP call, specifically targeting the SuperUserSetuserModuleFrontController:init component. Recommendations: For version...

PT-2023-32114 · WordPress · Cits Support Svg

Name of the Vulnerable Software and Affected Versions: CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin versions prior to 3.0 Description: The issue concerns the failure to sanitise uploaded SVG files, potentially allowing users with a role as low as Author to upload maliciou...

PT-2023-31965 · WordPress · Memberlite Shortcodes

Name of the Vulnerable Software and Affected Versions: Memberlite Shortcodes WordPress plugin versions prior to 1.3.9 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admi...

PT-2023-27237 · Chef · Chef Automate

Name of the Vulnerable Software and Affected Versions: Chef Automate versions prior to and including 4.10.29 Description: The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted...

PT-2023-32401 · Pkp/Ojs · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: pkp/ojs versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/ojs. Recommendations: For versions prior to 3.3.0-16, update to version 3.3.0-16 or later to...

PT-2023-32402 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - DOM in the GitHub repository pkp/pkp-lib. This type of attack occurs when an application includes user input in its output without proper...

PT-2023-30305 · Unknown · Virtualmin

Name of the Vulnerable Software and Affected Versions: Virtualmin version 7.7 Description: A Stored Cross-Site Scripting XSS issue in the Server Template under System Setting in Virtualmin allows remote attackers to inject arbitrary web script or HTML via the Template name field while creating...

PT-2023-28763 · Click Studios · Passwordstate

Name of the Vulnerable Software and Affected Versions: Click Studios SA Pty Ltd Passwordstate versions Build 9785 and before Description: A Cross Site Request Forgery vulnerability allows a local attacker to execute arbitrary code via a crafted request. Recommendations: For versions Build 9785 an...

PT-2023-32399 · Pkp · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.3.0-16 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject...

PT-2023-18085 · Google · Android

Name of the Vulnerable Software and Affected Versions: In Content affected versions not specified Description: The issue allows an attacker to determine whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information disclosu...

PT-2023-29870 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.8.0 Description: The issue concerns the default email address for the initial admin user, which is set to [email protected]. This could potentially affect password reset functionality if the domain mycompany.c...

PT-2023-31276 · Opentext · Opentext Asset Management X +1

Name of the Vulnerable Software and Affected Versions: opentext Service Management Automation X SMAX versions 2020.05 through 2022.11 opentext Asset Management X AMX versions 2021.08 through 2022.11 Description: The issue is an open redirect vulnerability that could allow attackers to redirect a...

PT-2023-30249 · Crafter · Crater

Name of the Vulnerable Software and Affected Versions: crater versions 6.0.0 through 6.0.6 Description: The issue allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image, specifically through the "/api/v1/company/upload-logo"...

PT-2023-7245

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue is related to improper validation in the aiohttp HTTP client/server framework, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP method. This can...

PT-2023-9032 · Unknown +8 · Exfatprogs +8

Name of the Vulnerable Software and Affected Versions: exfatprogs versions prior to 1.2.2 Description: The issue is related to the read file dentry set function in the exfatprogs utility, which is associated with out-of-bounds memory access. This could allow an attacker to impact data integrity...